Recovering NTFS drive with safecopy

data-recoveryntfs

Several days ago, I dropped my USB external hard disk. As a result, I cannot read some of the files. I would like to recover it, and now I am using safecopy. I used the following command,

sudo safecopy /dev/sdb1 data.img --stage1

However, at around 93%, then there is a message something like "cannot read from source".
Then I tried to mount this partially recovered image, but failed. What are the things I can do more to recover the data?

==================================================================

I have tried to use

sudo safecopy /dev/sdb data.img --stage1

Now, it is done. Then, I

fdisk -lu data.img

It produces this result,

Disk data.img: 310.8 GB, 310798626816 bytes
255 heads, 63 sectors/track, 37785 cylinders, total 607028568 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0xb1bec32c

   Device Boot      Start         End      Blocks   Id  System
data.img1              63   625137344   312568641    7  HPFS/NTFS/exFAT

Then, I tried to mount with

sudo mount -o loop,offset=32256 -t ntfs data.img /mnt/temp

but failed with this output

Failed to read last sector (625137281): Invalid argument
HINTS: Either the volume is a RAID/LDM but it wasn't setup yet,
   or it was not setup correctly (e.g. by not using mdadm --build ...),
   or a wrong device is tried to be mounted,
   or the partition table is corrupt (partition is smaller than NTFS),
   or the NTFS boot sector is corrupt (NTFS size is not valid).
Failed to mount '/dev/loop0': Invalid argument
The device '/dev/loop0' doesn't seem to have a valid NTFS.
Maybe the wrong device is used? Or the whole disk instead of a
partition (e.g. /dev/sda, not /dev/sda1)? Or the other way around?

How should I do to recover the data from here?

Best Answer

First, you may want to try safecopy --stage2 and safecopy --stage3 as well, to try to extract a little more from the disk.

If your copy is partial, you have a damaged filesystem. Run fsck on it (e.g. fsck -y copy-of-data.img) to attempt to repair. Note that for NTFS, you'll need a recent version of NTFS-3g. Repairing means turning the filesystem into a valid filesystem, it may well lose some of the data. So do this on a copy of the image. Then mount the image and try to recover files from it: sudo mount -o loop copy-of-data.img /mnt. Note that if fsck finds some data that it's unable to relate to a file name, it'll store it under the lost+found directory.

Sometimes, when fsck runs, it discards data because that data doesn't seem to belong to any file. A different approach for data recovery is to look for fragments on the disk that look like useful data. This works especially well for file formats that have a recognizable header, such as pictures. So try running carving tools on the copy of the disk image where you haven't run fsck. See How to recover data from a bad SD card? If these carving tools aren't easily available on your system, try the Testdisk live CD.

Related Question